In real operations, the gap between “fixed in minutes” and “lost the whole afternoon” often comes down to having small, reliable tools for triage and maintenance. Linux is full of utilities like that: not flashy, not new, but incredibly effective when you’re on-call.

Here’s a practical shortlist of underrated commands with examples and a sysadmin-first mindset.

1) `ncdu`: find what’s eating your disk—fast

ncdu (NCurses Disk Usage) is basically du with an interactive UI in the terminal. Perfect when a server is running out of space and you need the culprit quickly (logs, cache, container layers, old backups).

Examples:

ncdu /ncdu /var

Ops tips:

Run with privileges to see protected paths: sudo ncdu /var
Avoid crossing filesystems when you don’t want to: sudo ncdu -x /
Usual hotspots: /var/log, /var/lib, /home, /srv, /opt

2) `tldr`: the “battle manual” with straight-to-the-point examples

man pages are thorough, but during an incident you want correct examples, not option archaeology. tldr gives community-maintained, common usage patterns.

Examples:

tldr rsynctldr tartldr find

Why it helps:

Great for refreshing syntax right before running something risky (e.g., rsync --delete, archive commands, firewall rules).

3) `lsof`: identify who’s holding a file or a port

When something “can’t be deleted” or a port “is already in use”, lsof usually gives you the fastest, most accurate answer.

Which process is using a file?

sudo lsof /path/to/file

Who’s listening on a given port?

sudo lsof -i :443sudo lsof -iTCP-sTCP:LISTEN

Common scenarios:

Log rotation fails because a process still holds an open descriptor
A service won’t start because the port is busy
A filesystem won’t unmount because something is still inside it

4) `pgrep` / `pkill`: manage processes without `ps | grep`

Simple, reliable, and very “on-call friendly”: search or terminate processes by name without fragile pipelines.

Find PIDs by name:

pgrep nginxpgrep -a nginx

Kill by name (carefully):

pkill nginxpkill -f"python app.py"

Best practice:

Try graceful signals before -9 (SIGKILL):

pkill -TERM nginxpkill -HUP nginx

pkill -f matches the full command line—verify first with pgrep -af.

5) `rsync`: “surgical” copies and predictable migrations

rsync is the go-to tool for efficient syncs: copies only deltas, preserves metadata, and works over SSH. Great for migrations, backups, and repeatable transfers.

Basic sync:

rsync -avh /source/ /dest/

Mirror mode (watch --delete):

rsync -avh--delete /source/ /dest/

For real migrations: dry-run first

rsync -avh--info=progress2 --dry-run /source/ /dest/

Over SSH:

rsync -avh-e ssh /source/ user@host:/dest/

Important detail:

Trailing slash matters: /source/ copies contents; /source copies the directory itself.

6) `curl ifconfig.me`: get your public IP instantly

Handy in remote support or quick network checks.

curl ifconfig.me

Note:

This depends on an external service. In locked-down environments, prefer internal endpoints or approved alternatives.

7) `tree`: show directory structure without ambiguity

Useful for documenting deployments, reviewing repos, or explaining layouts to someone quickly.

Examples:

treetree -L2

More useful flags:

tree -d# directories onlytree -a# include dotfilestree -L3 /srv # limit depth on big paths

8) `dstat`: quick “live” view of CPU, disk, network, memory

For a fast console dashboard during triage, dstat is great at showing multiple subsystems at once.

Examples:

dstatdstat -cdnm

Heads-up:

Some distros replaced dstat with forks like dool. If dstat isn’t available, there’s often a near drop-in alternative.

Fast incident checklist

Disk full: ncdu /var → locate growth → clean with intent (logs, cache, backups).
Port conflict / service won’t start: lsof -i :PORT → identify process → stop properly or pkill with care.
Runaway process: pgrep -af name → confirm targets → pkill -TERM name.
Migration / incremental backup: rsync + --dry-run before final pass.
Quick system snapshot: dstat -cdnm while reproducing load or the issue.